Re: [Doh] conflict between HTTP and DNS cache granularity

section 6 tries to deal with this..

On Mon, Mar 19, 2018 at 11:21 PM, Petr Špaček <petr.spacek@nic.cz> wrote:

> Hello doh,
>
> section 7.1.  Cache Interaction at the moment does not mention
> difference between DNS and HTTP caching granularity.
>
> Observations:
> - DNS answer might contain more than 1 RR type (CNAME + original QTYPE)
> - DNS TTL is per-RRset but HTTP caching header is per request, which in
> terms of DoH means per DNS message (which potentially combines multiple
> RRsets)
>
> Thus the HTTP "TTL" has to be derived somehow, most likely using minimal
> value from all RRsets present in the DNS message.
>
> Without this limit a bad things will happen when DNS message "partially"
> expires, which is not handled by DoH protocol itself and will be
> detected late in the process on the DoH client side.
>
> E.g. a browser receives cached DoH answer from a caching proxy. It
> contains the same DNS message as before with following RRs and headers:
> ; Age = 20
> www.example.com. 100 CNAME srv.example.net.
> srv.example.net. 10      A 192.0.2.1
>
> Now, the srv.example.net. A RR has TTL -10 seconds so its invalid and
> client has to deal with it somehow. It is up to WG to decide whether
> client should re-query for expired RRs by itself or if DoH server should
> handle this by shortening TTLs so the client cannot encounter this
> partial expiration ...
>
> Well, mixing DNS and HTTP semantics is fun.
>
> --
> Petr Špaček  @  CZ.NIC
>
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh
>